Changeset 107:4586e930769b in roaraudio

Timestamp:

07/13/08 02:50:30 (16 years ago)

Author:

phi

Branch:

default

Phase:

public

Message:

fixed overflow bugs

Location:

roard

Files:

• meta.c (modified) (3 diffs)
• req.c (modified) (2 diffs)

roard/meta.c

@@ -39 +39 @@
    }
 
-   if ( (c = malloc(strlen(val))) == NULL ) {
+   if ( (c = malloc(strlen(val)+1)) == NULL ) {
     s->meta[i].type = ROAR_META_TYPE_NONE;
     s->meta[i].key[0] = 0;
@@ -58 +58 @@
 
 int stream_meta_get   (int id, int type, char * name, char * val, size_t len) {
- int i;
+ int i, vallen;
  struct roar_stream_server * s = g_streams[id];
 
@@ -70 +70 @@
      continue;
 
-   if ( strlen(s->meta[i].value) > (len - 1) )
+   if ( (vallen = strlen(s->meta[i].value)) > (len - 1) ) {
+    ROAR_DBG("stream_meta_get(*): val too small: need %i have %i", vallen, len);
     return -1;
+   }
 
-   strcpy(val, s->meta[i].value);
+   strncpy(val, s->meta[i].value, vallen);
+   val[vallen] = 0;
 
    return 0;

roard/req.c

@@ -203 +203 @@
  int vallen;
  int type;
- char val[LIBROAR_BUFFER_MSGDATA-2];
+ char val[LIBROAR_BUFFER_MSGDATA-1];
 
  if ( mes->datalen != 2 )
@@ -224 +224 @@
  mes->data[1] = (unsigned char) vallen;
 
- strncpy(&(mes->data[2]), val, vallen);
+ val[vallen] = 0;
+
+ strncpy(&(mes->data[2]), val, vallen+1);
 
  return 0;